CVE-2025-52040: SQL Injection
Published Oct 1, 2025
·Updated
In Frappe ERPNext 15.57.5, the function getblanketorders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanketordertype parameter.
Affected Software
2 affected components
Frappe ERPNext
Frappe ERPNext=15.57.5
Remediation
Event History
Oct 1, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-52040?
CVE-2025-52040 is classified as a critical SQL Injection vulnerability that can lead to unauthorized data access.
2
How do I fix CVE-2025-52040?
To mitigate CVE-2025-52040, update Frappe ERPNext to the latest version where the vulnerability is patched.
3
What systems are affected by CVE-2025-52040?
CVE-2025-52040 affects Frappe ERPNext version 15.57.5.
4
What kind of attack can exploit CVE-2025-52040?
An attacker can exploit CVE-2025-52040 through SQL Injection to extract sensitive data from databases.
5
Is there a workaround for CVE-2025-52040?
Currently, the best approach to address CVE-2025-52040 is to apply the available software update.